[Unit]
Description=picosnitch

[Service]
Type=simple
Restart=always
RestartSec=5
ExecStart=/usr/bin/picosnitch start-no-daemon
PIDFile=/run/picosnitch/picosnitch.pid

# Auto-create FHS dirs (so ProtectSystem/ReadWritePaths can bind them on a clean install)
RuntimeDirectory=picosnitch
StateDirectory=picosnitch
LogsDirectory=picosnitch
CacheDirectory=picosnitch
ConfigurationDirectory=picosnitch

# Required for libbpf to mmap the per-cpu perf event ring buffers
# (~16 MiB by default) without hitting the inherited 8 MiB cap.
LimitMEMLOCK=infinity

# Hardening
ProtectHome=read-only
ProtectSystem=strict
ReadWritePaths=/var/lib/picosnitch /var/log/picosnitch /run/picosnitch /var/cache/picosnitch
PrivateTmp=yes
NoNewPrivileges=yes
CapabilityBoundingSet=CAP_BPF CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_PERFMON CAP_SETGID CAP_SETUID CAP_SYS_ADMIN CAP_SYS_PTRACE
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
RestrictRealtime=yes
LockPersonality=yes
RestrictSUIDSGID=yes

[Install]
WantedBy=multi-user.target
